The following updates has been released for Debian:

[DLA 645-1] bind9 security update
[DLA 646-1] zendframework security update
[DSA 3687-1] nspr security update
[DSA 3688-1] nss security update

[DLA 645-1] bind9 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package : bind9
Version : 1:9.8.4.dfsg.P1-6+nmu2+deb7u11
CVE ID : CVE-2016-2775 CVE-2016-2776
Debian Bug : 831796 839010

CVE-2016-2775

lwresd crash with long query name
Backport of upstream commit 38cc2d14e218e536e0102fa70deef99461354232.

CVE-2016-2776

assertion failure due to unspecified crafted query
Fix based on 43139-9-9.patch from ISC.

For Debian 7 "Wheezy", these problems have been fixed in version
1:9.8.4.dfsg.P1-6+nmu2+deb7u11.

We recommend that you upgrade your bind9 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[DLA 646-1] zendframework security update

Package : zendframework
Version : 1.11.13-1.1+deb7u5
CVE ID : CVE-2016-4861

CVE-2016-4861
The implementation of ORDER BY and GROUP BY in Zend_Db_Select
remained prone to SQL injection when a combination of SQL
expressions and comments were used. This security patch provides
a comprehensive solution that identifies and removes comments
prior to checking validity of the statement to ensure no SQLi
vectors occur.

For Debian 7 "Wheezy", these problems have been fixed in version
1.11.13-1.1+deb7u5.

We recommend that you upgrade your zendframework packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[DSA 3687-1] nspr security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3687-1 security@debian.org
https://www.debian.org/security/ Florian Weimer
October 05, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : nspr
CVE ID : CVE-2016-1951
Debian Bug : 583651

Two vulnerabilities were reported in NSPR, a library to abstract over
operating system interfaces developed by the Mozilla project.

CVE-2016-1951

q1 reported that the NSPR implementation of sprintf-style string
formatting function miscomputed memory allocation sizes,
potentially leading to heap-based buffer overflows

The second issue concerns environment variable processing in NSPR.
The library did not ignore environment variables used to configuring
logging and tracing in processes which underwent a SUID/SGID/AT_SECURE
transition at process start. In certain system configurations, this
allowed local users to escalate their privileges.

In addition, this nspr update contains further stability and
correctness fixes and contains support code for an upcoming nss
update.

For the stable distribution (jessie), these problems have been fixed
in version 2:4.12-1+debu8u1.

For the unstable distribution (sid), these problems have been fixed in
version 2:4.12-1.

We recommend that you upgrade your nspr packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3688-1] nss security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3688-1 security@debian.org
https://www.debian.org/security/ Florian Weimer
October 05, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : nss
CVE ID : CVE-2015-4000 CVE-2015-7181 CVE-2015-7182 CVE-2015-7575
CVE-2016-1938 CVE-2016-1950 CVE-2016-1978 CVE-2016-1979
CVE-2016-2834
Debian Bug : 583651

Several vulnerabilities were discovered in NSS, the cryptography
library developed by the Mozilla project.

CVE-2015-4000

David Adrian et al. reported that it may be feasible to attack
Diffie-Hellman-based cipher suites in certain circumstances,
compromising the confidentiality and integrity of data encrypted
with Transport Layer Security (TLS).

CVE-2015-7181
CVE-2015-7182
CVE-2016-1950

Tyson Smith, David Keeler, and Francis Gabriel discovered
heap-based buffer overflows in the ASN.1 DER parser, potentially
leading to arbitrary code execution.

CVE-2015-7575

Karthikeyan Bhargavan discovered that TLS client implementation
accepted MD5-based signatures for TLS 1.2 connections with forward
secrecy, weakening the intended security strength of TLS
connections.

CVE-2016-1938

Hanno Boeck discovered that NSS miscomputed the result of integer
division for certain inputs. This could weaken the cryptographic
protections provided by NSS. However, NSS implements RSA-CRT leak
hardening, so RSA private keys are not directly disclosed by this
issue.

CVE-2016-1978

Eric Rescorla discovered a user-after-free vulnerability in the
implementation of ECDH-based TLS handshakes, with unknown
consequences.

CVE-2016-1979

Tim Taubert discovered a use-after-free vulnerability in ASN.1 DER
processing, with application-specific impact.

CVE-2016-2834

Tyson Smith and Jed Davis discovered unspecified memory-safety
bugs in NSS.

In addition, the NSS library did not ignore environment variables in
processes which underwent a SUID/SGID/AT_SECURE transition at process
start. In certain system configurations, this allowed local users to
escalate their privileges.

This update contains further correctness and stability fixes without
immediate security impact.

For the stable distribution (jessie), these problems have been fixed in
version 2:3.26-1+debu8u1.

For the unstable distribution (sid), these problems have been fixed in
version 2:3.23-1.

We recommend that you upgrade your nss packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/